Reference Manual

10.5.9
- 10.5.8
- 10.5.6
- 10.5.5
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5.1
- 10.5
- 10.4.1
- 10.4.0 HotFix 1
- 10.4.0

Back Next

Making Personal Certificates Available on z/OS

To create a personal or subject identification certificate use RACF or another facility such as ACF2 or TopSecret.

Depending on your site's standards, you can create personal (server) certificates on z/OS or you can create them on another platform and import them into z/OS. For testing purposes, you might want to create a self-signed certificate because it requires a lower level of RACF authority than is required to create a certificate signed by a CA. You might also create a self-signed certificate, which is then used to create a "certificate signing request” (CSR). You can then use the CSR to obtain a certificate, which is signed by another CA, such as a company in-house certificate authority.

The root CA certificate used in the signing of the personal certificate must be made available to clients if the clients are to authenticate the server.

A personal certificate is associated with a private key, but that key is not part of the certificate itself. The public key associated with the private key forms part of the certificate. The private key can be generated automatically by RACF and stored either in the RACF database or can be stored by z/OS ICSF depending on the options specified, although it is also possible to use an existing private key. In contrast to OpenSSL it is not necessary to be concerned about the location of the private key when using a personal certificate because RACF automatically retrieves it.

The following steps assume you are using RACF and that the RACF administrator has already created a suitable CA (site) certificate.

Create a key ring.

Make a personal certificate available on z/OS.

Connect the personal certificate to the key ring.

Connect the CA certificate to the key ring.

Export the CA certificate for use on the client, if necessary.

The following example RACF commands perform these steps where the pre-existing signing CA certificate is LOCALCA. They also create a private key. To create a self-signed certificate, rather than one signed by LOCALCA, remove the ‘SIGNWITH’ clause and replace the following parameters in the EXPORT command:

LABEL(LOCALCA) CERTAUTH

with:

LABEL('MYUSERIDCert1') ID(MYUSERID)

Example:

/* Create a Keyring for the application                   */
RACDCERT ID(MYUSERID) ADDRING(ATTLS_keyring)
SETROPTS RACLIST(DIGTCERT,DIGTNMAP,DIGTRING) REFRESH 

/* Create a certificate for the Server application        */ 
RACDCERT ID(MYUSERID) GENCERT -                     
  SUBJECTSDN ( -                               
    O('MyCompany') -                         
    CN('MYUSERID.mymachine.myorganization.com') -       
    OU('myorganizationunit') -                          
    C('GB') -                                  
            )          -                       
   WITHLABEL('MYUSERIDCert1')-                       
   SIGNWITH(CERTAUTH LABEL('LOCALCA'))          
 SETROPTS RACLIST(DIGTCERT,DIGTNMAP) REFRESH  
  
/* Connect the server certificate to the server’s keyring.*/ 
RACDCERT ID(MYUSERID) CONNECT(ID(MYUSERID) -  LABEL('MYUSERIDCert1') –
RING(ATTLS_keyring) –
DEFAULT –
USAGE(personal))                            
SETROPTS RACLIST(DIGTCERT,DIGTNMAP) REFRESH
    
/* Connect the CA certificate to the server's keyring     */ 
RACDCERT ID(MYUSERID) CONNECT(CERTAUTH –
LABEL('LOCALCA') –
RING(ATTLS_keyring) -  USAGE(certauth))      
SETROPTS RACLIST(DIGTCERT,DIGTNMAP) REFRESH  
/* Export the CA certificate for use by the client (for a self-signed certificate to the server's keyring.*/  
/* It will be stored as text in CERTB64 format which is compatible with PEM format.*/

RACDCERT EXPORT (LABEL(‘LOCALCA’)  CERTAUTH -
   DSN(‘MYUSERID.LOCALCA.CER’)

Rename Saved Search

Table of Contents

Reference Manual

Reference Manual

Making Personal Certificates Available on z/OS

Making Personal Certificates Available on z/OS